Live Change Log

Turns §164.312(b) from a log line into evidence. The capture layer has been wired across seven services for a while, but it wrote through Slf4jPhiAccessLogWrite...

Adds the HMDA ULI to the LAR export. UliMinter builds the ULI = org LEI(20) + loan number + two ISO 7064 MOD 97-10 check digits (Mod97CheckDigit — the IBAN algo...

MfaEnrollmentService shipped with @Service. Every Kamo service carries @ComponentScan("com.kamo"), so all of them construct it — but each declares its own EXPLI...

MfaEnrollmentService is a @Service and every Kamo service component-scans com.kamo, so it is instantiated in roughly forty applications. It had two constructors...

The compliance assessment called the absence of any second factor disqualifying on its own, and under the 2025 Security Rule NPRM MFA stops being addressable at...

Adds a first-class Quote alongside the existing commerce spine. The pre-existing "ServiceQuote" is an Intent plus a JSON blob carrying one offering and one flat...

Backing store and queries for the mailbox sender-avatar chain. SenderIdentityEntity is the durable tier of the avatar cache. org_id is part of the natural key ...

The Security Rule requires recording access to ePHI, which means reads. The platform records changes well — LeadHistory, SystemAccessLog, UserHistory, LoanAudit...

Wires PhiTenantGuard into FeatureService, the single choke point through which a module is switched on for an organization. This is where the boundary stops bei...

LoanFile.loanNumber was null on create (both blank-create and lead-promote) and only ever set when a steward typed one — which hard-blocked MERS MIN minting (a ...

Backs PhiTenantGuard with a real column. HANDLES_PHI is NOT NULL DEFAULT FALSE following the **************** pattern, so every existing tenant is explicitly ou...

The keystone of the HIPAA compliance boundary: which modules a tenant may reach, given whether that tenant handles protected health information. Everything down...

This reverts commit ****************

The keystone of the HIPAA compliance boundary: a per-organization flag plus a guard deciding which modules that organization may reach. Everything downstream ke...

- **************** contactEmail branch (company contact email editable via PUT /api/security/org, used as company-scope campaign From) - ApplicationRepository...

The issuance mechanism's shared-lib half. ComplianceTimerService gains **************** — flips only ARMED ECOA_AA timers to SATISFIED (leaves COUNTEROFFER/INCO...

Adds the shared-library foundation for org-level bulk email campaigns: - OrgBulkEmailProviderEntity (separate from everyday provider; UNIQUE org_id) - EmailCamp...

The routed-decision steward notification needs a canonical email template. Registers STEWARD_TASK_ROUTED in CANONICAL_KEYS with its json/html pair; body carries...

Adds a contact-level `dateOfBirth` (java.time.LocalDate, DATE column) to the base Lead: entity + Create/Update/LeadDTO (fromLead), copied in LeadService create/...

Both templates ship as resource pairs on disk (welcome-member.{json,html}, **************** with matching templateKeys, and EmailService already has their sampl...

assignLead had zero callers and had never run in production. Before wiring the bulk reassignment path to it, give it the guarantees that path needs: - take org...

Org branding endpoints (logos, colors, backgrounds, theme provisioning) were owner-or-god only, leaving no way to delegate branding without handing over ownersh...

SUSPENDED is deliberately not terminal — LoanFileStatus.isTerminal excludes it, because a loan is suspended for a fixable reason. But it had no forward arrow, s...

The client field-initialized a bare `new RestTemplate()`, so no timeout applied on any AI call and no builder could reach it. A hung provider blocked the caller...

Twelve @Query aggregates across sessions, messages, usage records and outbound touches, so a scorecard is a handful of grouped queries rather than loading rows ...

Replaces the single training-context blob with a structured, versionable agent model, and adds the per-contact spine an agent needs before it may initiate conta...

Org-configurable AI sales agents: a named agent for a sales industry, programmed with a training context the org authors (from a template or by hand), assignabl...

Foundation for making the reusable public-chat widget handle the KamoMLOS borrower->loan-officer variant securely, and for propagating lead reassignment into an...

Investor rate sheets / LLPA + eligibility matrices / lock policies need somewhere to live: the ingest extracts from the blob, and the published rate-sheet versi...

personal phone or must be on a company-managed (Android Device Owner enrolled) device: - MobileDevicePolicy enum: PERSONAL_ALLOWED | COMPANY_MANAGED_REQUIRED. ...

Completes the owner-column lookups the MLOS identifier plane needs to route inbound callbacks: **************** (DU/LP/GUS run handle) and **************** Both...

The MLOS identifier plane resolves an inbound vendor/agency callback back to a loan; for OWNED_ELSEWHERE types the authoritative value lives on the OWNER's colu...

The borrower-facing half of the conditions loop: two generic checklist templates for the new condition notification consumer. Added to CANONICAL_KEYS with their...

Add **************** as the single source of truth for the "only ACTIVE members may sign in or appear as a live participant" invariant: base members must be rec...

- MlosCommitment.boardedAt: in-system marker for a PURCHASED commitment's loans boarded to servicing (the external servicing-system handoff is the blocked leg...

Slice 2 foundation for the capital-markets loan-sale desk (doc 08) — the terminal origination stage. The shipped **************** had NO runtime consumer; these...

Splits the ClosingArtifact @PreUpdate WORM guard so the eClose vendor dispatch can move OUT of the assemble/advance transaction (doc 05 §6): the node commits FI...

- VendorCategory gains the four notarized-leg rails so the integrations tab can configure a per-org RON/eNote/eVault/MERS vendor (additive STRING enum, no CHE...

**************** — locks key on scenario, so resolve a loan's locks via MlosLoanScenario.loanFileUid. Backs the borrower/steward 'is this loan rate-locked?' rea...

The per-borrower repeating sections were write-only; add read projections **************** so the borrower capture UIs can hydrate existing rows via GET endpoin...

VendorOrder extends BaseUuidEntity (key = uid, not id); the derived-query parse failed at boot ("No property 'id' for VendorOrder"), crash-looping MLOSVendorSer...

The greenfield 3rd-party order-of-record **************** SCRA). VendorOrder = partial-WORM async order (ClosingArtifact idiom: opaque vendorKey/externalRef, fr...

The one PITI component not stored on the loan. Standard fully-amortizing formula P·r·(1+r)^n/((1+r)^n−1); zero rate degrades to straight-line; non-positive prin...

Rolls a loan's obligations up to the funding question the end-to-end gap analysis raised ("service the loan all the way to funding"): clear-to-close iff zero ad...

Composes the four cores (income, liabilities, PITI/DTI, reserves) into ONE QualifyingSnapshot: qualifying income, reconciled monthly debt, assembled PITIA, fron...

Derives reserve months from actual assets with standard agency haircuts — liquid deposits 100%, brokerage 70%, vested retirement 60%, gift/borrowed excluded — d...

Pure ratio core completing the DTI trio with LiabilityReconciler + the income core: PITIA = P&I + taxes + HOI + HOA + MI + flood; front = PITIA / income; back =...

Pure/deterministic income core: base salaried = conservative lowest-of available evidence (paystub / W-2 / VOE); variable = 2-yr average with a declining-income...